Encrypt annotation data payloads on encrypted channels

[SimonWoolf]

Annotation had no encrypt() method at all, so annotation data was published in plaintext even when the channel had a cipher configured — while Message (ably/types/message.py:235) and PresenceMessage (ably/types/presence.py:123) were correctly encrypted before serialisation at their publish sites (ably/rest/channel.py:80, ably/realtime/channel.py:415).

The REST get() path compounded it by hardcoding cipher=None when building its response handler, so it could not have decrypted an encrypted annotation either. The realtime receive path (ably/realtime/channel.py:768) already passed cipher=self.cipher correctly, so it was only the REST direction that was broken.

Changes

• Add Annotation.encrypt(), mirroring Message.encrypt().
• Call it from both publish paths (rest/annotations.py, realtime/annotations.py), guarded on channel.cipher like the message paths are.
• Pass the channel's cipher when decoding REST get() responses.
• Remove three docstrings asserting annotations are not encrypted (see below).

One deliberate difference from Message.encrypt(): annotations very commonly carry no data at all — a reaction is fully described by its name, and every existing annotation test passes data=None. Message.encrypt() would raise TypeError: Unexpected object type <class 'NoneType'> from TypedBuffer.from_obj() on that input; it just never gets called that way in practice. Annotation.encrypt() returns early instead. Worth noting Message.encrypt() has the same latent flaw if it is ever called with data=None, but I have left it alone.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d3595a84-cacd-4809-a1bd-079c0c266d52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}